Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: Extracting The Overlay Of A PE File - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Extracting The Overlay Of A PE File

In diary entries "Huge Signed PE File" and "Huge Signed PE File: Keeping The Signature" I explain how to get rid of the overlay in a huge PE file.

What commands do you need to issue if you do want the overlay (e.g., for analysis)?

To achieve this, you follow the steps as I explained here, up until the extraction of the stripped PE file (-g s). Issue a similar extraction command, but use -g o (o stands for overlay) to extract the overlay.

Didier Stevens
Senior handler
Microsoft MVP


649 Posts
ISC Handler
May 29th 2022

Sign Up for Free or Log In to start participating in the conversation!